1. 查看SELinux状态

1.1 getenforce

getenforce 命令是单词get（获取）和enforce(执行)连写，可查看selinux状态，与setenforce命令相反。
setenforce 命令则是单词set（设置）和enforce(执行)连写，用于设置selinux防火墙状态，如： setenforce 0用于关闭selinux防火墙，但重启后失效

[root@localhost ~]# getenforce
Enforcing
1.2 /usr/sbin/sestatus

Current mode表示当前selinux防火墙的安全策略

[root@localhost ~]# /usr/sbin/sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Max kernel policy version: 28
SELinux status：selinux防火墙的状态，enabled表示启用selinux防火墙
Current mode： selinux防火墙当前的安全策略，enforcing 表示强

2. 关闭SELinux

2.1 临时关闭

setenforce 0 ：用于关闭selinux防火墙，但重启后失效。

[root@localhost ~]# setenforce 0
[root@localhost ~]# /usr/sbin/sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: targeted
Current mode: permissive
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Max kernel policy version: 28
2.1 永久关闭

修改selinux的配置文件，重启后生效。

打开 selinux 配置文件

[root@localhost ~]# vim /etc/selinux/config
修改 selinux 配置文件

将SELINUX=enforcing改为SELINUX=disabled，保存后退出

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing – SELinux security policy is enforced.
# permissive – SELinux prints warnings instead of enforcing.
# disabled – No SELinux policy is loaded.
SELINUX=enforcing
# SELINUXTYPE= can take one of three two values:
# targeted – Targeted processes are protected,
# minimum – Modification of targeted policy. Only selected processes are protected.
# mls – Multi Level Security protection.
SELINUXTYPE=targeted
此时获取当前selinux防火墙的安全策略仍为Enforcing，配置文件并未生效。

[root@localhost ~]# getenforce
Enforcing
重启

[root@localhost ~]# reboot
验证

[root@localhost ~]# /usr/sbin/sestatus
SELinux status: disabled

1.安装docker环境

yum install docker

2.安装docker-compose，不要直接使用yum的方式安装，因为yum的方式版本较低，且与系统可能存在兼容问题。

curl -L https://github.com/docker/compose/releases/download/1.21.2/docker-compose-$(uname -s)-$(uname -m) -o /usr/local/bin/docker-compose

3.软件配置
docker-compose.yml文件配置如下：

version: '3.1'

services:
  mysql:
    image: mysql:5.5.60
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: abc123
    # links:
    ports:
      - 13306:3306
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /opt/mysql/data:/var/lib/mysql

  php:
    image: wordpress:php7.1-fpm
    restart: always
    ports:
      - 9000:9000
    links:
      - mysql:mysql
    depends_on:
      - mysql
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /opt/wwwroot:/home/wwwroot
      - /opt/wwwlogs:/home/wwwlogs
    # php-fpm运行的用户为www-data，需要将wwwroot的权限为[chmod a+w ]


  nginx:
    image: nginx
    restart: always
    ports:
      - 80:80
    links:
      - mysql
      - php
    depends_on:
      - mysql
      - php
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /etc/timezone:/etc/timezone:ro
      - /opt/nginx/conf/nginx.conf:/etc/nginx/nginx.conf:ro
      - /opt/nginx/conf/fastcgi.conf:/etc/nginx/fastcgi.conf:ro
      - /opt/nginx/conf/vhost:/etc/nginx/vhost:ro
      - /opt/wwwroot:/home/wwwroot
      - /opt/wwwlogs:/home/wwwlogs

/opt/nginx/conf/nginx.conf的配置如下：

user root root;

worker_processes auto;

error_log  /home/wwwlogs/nginx_error.log  crit;

pid        /home/wwwlogs/nginx.pid;

#Specifies the value for maximum file descriptors that can be opened by this process.
worker_rlimit_nofile 51200;

events
    {
        use epoll;
        worker_connections 51200;
        multi_accept on;
    }

http
    {
        include       mime.types;
        default_type  application/octet-stream;

        server_names_hash_bucket_size 128;
        client_header_buffer_size 32k;
        large_client_header_buffers 4 32k;
        client_max_body_size 50m;

        sendfile   on;
        tcp_nopush on;

        keepalive_timeout 60;

        tcp_nodelay on;

        fastcgi_connect_timeout 300;
        fastcgi_send_timeout 300;
        fastcgi_read_timeout 300;
        fastcgi_buffer_size 64k;
        fastcgi_buffers 4 64k;
        fastcgi_busy_buffers_size 128k;
        fastcgi_temp_file_write_size 256k;

        gzip on;
        gzip_min_length  1k;
        gzip_buffers     4 16k;
        gzip_http_version 1.1;
        gzip_comp_level 2;
        gzip_types     text/plain application/javascript application/x-javascript text/javascript text/css application/xml application/xml+rss;
        gzip_vary on;
        gzip_proxied   expired no-cache no-store private auth;
        gzip_disable   "MSIE [1-6]\.";

        #limit_conn_zone $binary_remote_addr zone=perip:10m;
        ##If enable limit_conn_zone,add "limit_conn perip 10;" to server section.

        server_tokens off;
        access_log off;
        
  	include vhost/*.conf;
}

/opt/nginx/conf/vhost/kxtry.com.conf的配置如下，它是放置在nginx.conf同级的vhost目录下。

server
{
        listen 80;
        server_name kxtry.com www.kxtry.com www.czysheng.com czysheng.com;
        index index.html index.htm index.php;
        root /home/wwwroot/kxtry.com;


        location ~ \.php {
		fastcgi_pass  php:9000;
                fastcgi_index index.php;
                include fastcgi.conf;
                set $real_script_name $fastcgi_script_name;
                if ($fastcgi_script_name ~ "^(.+?\.php)(/.+)$") {
                        set $real_script_name $1;
                        set $path_info $2;
                }
                fastcgi_param SCRIPT_FILENAME $document_root$real_script_name;
                fastcgi_param SCRIPT_NAME $real_script_name;
                fastcgi_param PATH_INFO $path_info;
		fastcgi_param IS_DEVELOPMENT '1'; 
		#develop and test environment
        }

	location / {
        	if (-f $request_filename/index.html){
            		rewrite (.*) $1/index.html break;
        	}	
        	if (-f $request_filename/index.php){
            		rewrite (.*) $1/index.php;
       		}	
        	if (!-f $request_filename){
            		rewrite (.*) /index.php;
        	}
	}


        access_log /home/wwwlogs/kxtry.com.log;
}

与nginx.conf同级的fastcgi.conf文件配置

fastcgi_param  SCRIPT_FILENAME    $document_root$fastcgi_script_name;
fastcgi_param  QUERY_STRING       $query_string;
fastcgi_param  REQUEST_METHOD     $request_method;
fastcgi_param  CONTENT_TYPE       $content_type;
fastcgi_param  CONTENT_LENGTH     $content_length;

fastcgi_param  SCRIPT_NAME        $fastcgi_script_name;
fastcgi_param  REQUEST_URI        $request_uri;
fastcgi_param  DOCUMENT_URI       $document_uri;
fastcgi_param  DOCUMENT_ROOT      $document_root;
fastcgi_param  SERVER_PROTOCOL    $server_protocol;
fastcgi_param  REQUEST_SCHEME     $scheme;
fastcgi_param  HTTPS              $https if_not_empty;

fastcgi_param  GATEWAY_INTERFACE  CGI/1.1;
fastcgi_param  SERVER_SOFTWARE    nginx/$nginx_version;

fastcgi_param  REMOTE_ADDR        $remote_addr;
fastcgi_param  REMOTE_PORT        $remote_port;
fastcgi_param  SERVER_ADDR        $server_addr;
fastcgi_param  SERVER_PORT        $server_port;
fastcgi_param  SERVER_NAME        $server_name;

# PHP only, required if PHP was built with --enable-force-cgi-redirect
fastcgi_param  REDIRECT_STATUS    200;
fastcgi_param PHP_ADMIN_VALUE "open_basedir=$document_root/:/tmp/:/proc/";

—————————-
无法上传或保存图片的原因是目录权限问题。
原php的用户为www-data，而映射到dock中都是root权限，故需要修改/wwwroot的权限为

chmod a+w kxtry.com -R
或者chown www-data:www-data kxtry.com -R